I use IPV6-PD to assign an IPV6 address to my LAN device. How do I configure a firewall? And how to enable RFC4941 and RFC7217 on the WAN port?

Installing and Using OpenWrt Network and Wireless Configuration
21

Then you can't use privacy secret on WAN, as you're actually being assigned an IP. And if it was randomly assigned, then it's private anyways.

That information is contained in the Wiki too. Feel free to review the documentation.

Just in case there was a misunderstanding - I noted reqprefix

Screenshot%20from%202019-12-03%2012-10-58
Screenshot%20from%202019-12-03%2012-10-581016×74 10.7 KB

22

Why do you want a privacy-enabled address on the WAN interface anyways?

Whether clients in your LAN use Privacy-Extensions or Stable-Secret-Addresses is up to the clients. OpenWrt doesn't do this. OpenWrt just announces a prefix to your LAN. The clients will assign addresses according to this.

23
  • We're referring to enabling Privacy Extensions on the OpenWrt
  • Perhaps you intended to reply to someone else (i.e. the OP)?

Although I'm not he OP, one good reason I can think of - is so the the device cannot be identified due to an EUI64 address.

1 Like
24

Yes, I meant to reply to OP.

Anyway, looking at the original post, @daiaji doesn't want PE on the OpenWrt. At least that's what I derive from the firewall rule. He wants people to access his web server which is a LAN client behind OpenWrt. He seems to be under the impression that OpenWrt handles the assignment of IPv6 addresses for clients.

Furthermore, if the WAN-IPv6 of the OpenWrt box is assigned by DHCPv6/PPPoE, it won't contain the MAC address anyways.